Request

Privaatsuspoliitika

Last updated: October 15, 2026

1. Purpose and Scope of this Privacy Policy

The purpose of this Privacy Policy (hereinafter – the Policy) by SIA Request, registration number: 40203423105, legal address: Stabu iela 109 – 1, Riga, LV-1009, Latvia (hereinafter – the Controller) is to inform the Controller’s customers, potential customers, cooperation partners and other persons about the Controller’s activities related to the processing and protection of personal data of natural persons who can be directly or indirectly identified (hereinafter – the Data Subject) under the brand request.host.

The Policy specifies what personal data of the Data Subject is processed, including obtained, transferred, corrected, stored, deleted, etc., the purposes of such data processing and the legal basis for such processing in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter – the Regulation), as well as the data retention periods and the rights of the Data Subject.

The Policy shall apply to the processing of personal data regardless of the form and/or medium in which the Data Subject provides or the Controller obtains the personal data (e.g. on the website of the Controller, in writing, orally, electronically by email or telephone, on the Controller’s social network profiles, etc.).

The Controller shall have the right to make changes to the Policy at its sole discretion. The Policy is available on the Controller’s website – www.request.host (hereinafter – the Website), as well as at the office and is applicable from the date of approval of the Policy.

The Policy concerns the Controller’s own account, billing, support, communication, security and Website processing, including in the customer portal at www.accounts.request.host and the hosting control panel www.console.request.host.

2. Information About the Controller

The Controller is SIA Request (hereinafter – Request), registration number: 40203423105, legal address: Stabu iela 109 – 1, Riga, LV-1009, Latvia, email address: [email protected]

The contact details in this Section may be used for privacy enquiries and the exercise of Data Subject rights.

3. Categories of Personal Data, Categories of Data Subjects, Purposes of Processing and Legal Basis

The Controller will normally process the personal data of the following Data Subjects:

  • Customers and their representatives;
  • Potential customers and their representatives;
  • Cooperation partners and their representatives;
  • Website visitors, account users and other persons communicating with the Controller.

The Controller shall process the data of natural persons lawfully, fairly and in a manner that is transparent to the Data Subject in order to:

  • Provide hosting and infrastructure services to customers;
  • Ensure and improve the quality of the services provided by the Controller;
  • Comply with the obligations imposed on the Controller by law;
  • Protect the Controller’s legitimate interests and the legitimate interests of the Data Subject.

The legitimate interests of the Controller are: to carry out and administer its business activities and relationships with business customers and their representatives, receive payments, ensure service quality and security, prevent abuse or unlawful use of services, and protect legal rights and interests. The Controller assesses necessity and balances these interests against the Data Subject’s rights and reasonable expectations.

The Controller will normally process the following categories of personal data:

  • Name, surname, professional role and authority to act;
  • Address, telephone number, email address and company contact information;
  • Bank-account and tax information, tax checks, payment and transaction references, status and limited card information;
  • Order, subscription and billing information, and contractual confirmations obtained and retained;
  • Account and organization identifiers, memberships, permissions and profile image;
  • Correspondence and support requests;
  • IP addresses, device or browser information, access logs and other technical information necessary for providing and maintaining the services.

Personal identification information is requested only where necessary for a justified purpose.

The legal basis for the processing of natural persons’ data by the Controller may be:

  • Article 6(1)(a) of the Regulation, which states that processing is lawful if the Data Subject has given his or her consent to the processing of his or her personal data for one or more specified purposes;

  • Article 6(1)(b) of the Regulation, which states that processing is lawful if the processing is necessary for the performance of a contract to which the Data Subject is a party or for taking measures at the request of the Data Subject prior to entering into the contract;

  • Article 6(1)(c) of the Regulation, which states that processing is lawful if the processing is necessary for compliance with a legal obligation to which the Controller is subject;

  • Article 6(1)(f) of the Regulation, which states that processing is lawful if the processing is necessary for the pursuit of the legitimate interests of the Controller or of a third party, except where the interests or fundamental rights and freedoms of the Data Subject which require the protection of personal data override such interests, in particular where the Data Subject is a child.

The Controller shall process identity, contact, account and order data to assess enquiries, prepare offers and enter into or perform an individual’s contract on the basis of Article 6(1)(b) of the Regulation. Communication with business customers’ or partners’ representatives and administration of those relationships is based on Article 6(1)(f) of the Regulation.

Administration of payments, subscriptions, refunds, support and necessary service notices is based on Article 6(1)(b) of the Regulation for an individual’s contract or Article 6(1)(f) for business relationships and legitimate financial interests. Invoicing, accounting and tax data is processed to comply with legal obligations under Article 6(1)(c). System protection, investigations of misuse and incidents, and the defence of claims rely on Article 6(1)(f) or Article 6(1)(c) where required by law.

Optional marketing communications and non-essential technologies requiring consent are based on Article 6(1)(a) of the Regulation, also subject to electronic-communications rules. Necessary account, billing and security notices do not depend on marketing consent.

Information comes from the Data Subject, the customer or organization represented, authorized contacts, relevant public business or tax registers, and systems and providers involved in delivering services. Technical data is also generated through use of the services.

Card details are processed by Stripe LLC group companies (hereinafter – Stripe) through the integrated payment interface. The Controller supplies necessary buyer names, contact names, email, address and transaction information, and processes payment references, status and limited card details such as the last four digits and expiry date. The Controller does not store the full card number or security code.

Failure to supply necessary contractual or invoicing information may prevent a contract being entered into or performed. Technical, access and payment controls may operate automatically. If a control results in a disputed restriction, the Data Subject may contact the Controller to review the circumstances and establish the appropriate resolution, including with a payment provider. Article 22 rights apply where its conditions are met.

Regarding personal data that a customer hosts and processes on the servers and infrastructure provided by the Controller, the Controller acts as a processor or subprocessor under the customer’s instructions. Such processing is governed by a separate Data Processing Agreement, rather than this Policy, available on the Controller’s website (www.request.host/data-processing-agreement). Requests about the customer’s use of that data should normally be addressed to the customer.

4. Duration of Storage of Personal Data

The Controller retains personal data only as long as necessary for the relevant purpose or legal obligation. Account and customer-administration data is retained during the relationship and necessary closure tasks. Invoices, transaction and tax evidence are retained for the statutory period applicable to the relevant accounting or tax document category.

Correspondence and support records are retained to resolve the matter and preserve necessary contractual evidence. Access and security logs are retained according to fault, misuse or incident investigation needs and risk. Detailed payment-system messages and diagnostics are retained only for necessary reconciliation, investigation or evidence, with restricted access and removal or redaction of unnecessary detail.

Consent and objection records are retained as necessary to demonstrate compliance and respect communication choices. Claim evidence is retained for the applicable limitation period or until proceedings conclude. Unneeded data is deleted or anonymized; restricted backup copies expire through their retention cycle. Customer-hosted data, its return, deletion and backups are governed by the Terms of Service and Data Processing Agreement.

5. Transfer of Personal Data Outside the European Union or the European Economic Area

Personal data processed by the Controller may be transferred to service providers processing it within or outside the European Union or European Economic Area (EEA), including in the United States. EEA server or backup storage does not by itself mean that all associated account, payment, communication, support or monitoring data is processed exclusively in the EEA.

Transfers comply with Chapter V of the Regulation through an applicable adequacy decision or appropriate safeguards, including European Commission standard contractual clauses and necessary supplementary measures. The EU–US Data Privacy Framework applies only to a covered certified recipient and processing. Information about recipient countries and applicable safeguards, including copies of those safeguards, may be requested from the Controller, subject to applicable confidentiality protections. Accepting terms or selecting a region is not blanket transfer consent.

6. Categories of Recipients of Personal Data

Where there is a legal basis and to the extent necessary for the relevant purpose, personal data may be transferred to authorities and courts, banks and payment providers, professional advisers, the Controller’s communication, document, accounting and other necessary software and technical-support providers, infrastructure, backup, network and security providers, service-monitoring and technical-log providers, and email-delivery providers. Website analytics and advertising providers receive data where the use of the relevant technologies has been permitted.

Personal data may also be accessed by authorized personnel requiring it for the relevant task.

Processors are engaged under appropriate data-protection and confidentiality arrangements. Stripe acts as a processor for certain services supplied on the Controller’s behalf and as a controller for its own purposes, including fraud prevention and legal compliance. Further information: www.stripe.com/legal/privacy-center. Subprocessors for customer-hosted data are identified in the Data Processing Agreement. Membership of a listed recipient category does not itself justify disclosure.

7. Security of Processing of Personal Data

The Controller shall ensure that personal data is processed in such a way as to ensure appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by means of appropriate technical or organizational measures.

These risk-appropriate measures include access restrictions, authentication, secure communication, system maintenance, confidentiality and appropriate backup and incident-handling arrangements. Access is limited to people and providers requiring it for an authorized purpose.

Measures are reviewed in light of the data, systems and risks. No storage or transmission method is entirely risk-free; this does not limit the Controller’s data-protection obligations.

8. Data Subject’s Access to Personal Data

The Data Subject shall have the right to obtain confirmation from the Controller as to whether or not personal data is being processed in relation to the Data Subject and, if so, the Data Subject shall have the right to access the relevant data and to obtain the information referred to in Article 15(1) of the Regulation.

The Data Subject shall have the right to request that the Controller rectifies inaccurate personal data of the Data Subject without undue delay. Taking into account the purposes of the processing, the Data Subject shall have the right to have incomplete personal data completed, including by providing a supplementary statement.

The Data Subject shall have the right, in accordance with the provisions of Article 17 of the Regulation, to obtain the erasure of personal data concerning him or her by the Controller without undue delay where one of the circumstances specified in that Article applies.

The Data Subject shall have the right to obtain restriction of processing by the Controller where one of the circumstances specified in Article 18 of the Regulation applies.

The Data Subject shall have the right, in the circumstances specified in Article 20 of the Regulation, to receive personal data provided to the Controller in a structured, commonly used, machine-readable format and transmit it to another controller. Where technically feasible, the Data Subject may have those data transmitted directly from the Controller to another controller. This right concerns automated processing based on consent or contract.

The Data Subject shall have the right to object to legitimate-interest processing on grounds relating to his or her situation. The Controller shall cease such processing unless applicable overriding grounds or the establishment, exercise or defence of claims justify it. The Data Subject may object to direct marketing at any time without justification.

The Data Subject shall have the right to withdraw his or her consent to the processing of his or her personal data, if such consent has been given. Withdrawal of consent shall not affect the lawfulness of processing before withdrawal.

Available personal account details may be changed via the hosting control panel (www.console.request.host); the Data Subject may contact the Controller to correct billing information.

In order to facilitate the processing of the Data Subject’s requests, the Data Subject may contact the Controller in writing, including by ordinary email or post, using the contact details specified in Section 2 of this Policy. A signature or identity document is not automatically required; proportionate additional verification may be requested where identity is reasonably in doubt.

Responses are provided without undue delay, ordinarily within one month. A lawful extension of up to two further months may apply, with reasons notified within the first month. Requests are ordinarily free; any lawful refusal or fee is explained.

The Data Subject shall also have the right to lodge a complaint with the Data State Inspectorate of the Republic of Latvia if the Data Subject considers that the Controller infringes the Data Subject’s rights and legitimate interests in the field of data protection of natural persons. Information on submitting a complaint is available at www.dvi.gov.lv/en. The Data Subject may also contact another competent supervisory authority, including in the Member State of habitual residence, work or alleged infringement.



9. Cookies and Similar Technologies

The customer portal and the hosting control panel use technologies needed for authentication, security, sessions and requested functions, and storage of interface preferences. The integrated Stripe payment interface may use cookies and similar technologies for payment authentication and fraud prevention. Website technologies and choices may differ from those of the portal or control panel. Optional Website analytics and advertising technologies are managed through Website consent settings, separately from necessary portal functions.

Further information and relevant choices are set out in the Cookies Policy (www.request.host/cookies-policy). Website consent may be changed or withdrawn using its “Manage Your Cookie Preferences” button. Technologies requiring consent are used only after consent. Browser settings also allow cookies to be blocked or deleted; blocking necessary technologies may affect functionality.

10. Jurisdiction-Specific Notices



11. Closing Remarks

This Privacy Policy may be amended as necessary, with the current version of the Policy being published on the Controller’s website. Material changes shall be appropriately notified. Necessary information and the applicable legal basis shall be addressed before data is used for a new purpose.

This Privacy Policy is also available on the Latvian language version of the Controller’s website (www.request.host/lv/privatuma-politika). In the event of any inconsistency or conflict between the English and Latvian versions, the Latvian version (www.request.host/lv/privatuma-politika) shall prevail in all respects, subject to the mandatory requirements of applicable law.

In case of any questions regarding the processing of personal data, the Controller may be contacted by sending a letter to the Controller’s legal address: Stabu iela 109 – 1, Riga, LV-1009, Latvia or by email: [email protected]